Re: [Assp-user] Spammer passing through

[Scott H. <tal...@ne...>]

On Mar 16, 2010, at 3:52 AM, Tomás Armán wrote:

> Hi!
> 
> I've using ASSP for 7 years, I'm addicted to it and install everywhere I 
> see a naked smtp server. Thumbs up for the best antispam software ever!
> 
> From a month now we are receiving a kind of spam that I can't make ASSP 
> catch, everybody in the domain is getting dozens per day, always of the 
> same format: the from field filled with an addres from within the 
> domain, body message short and polite redacted (bayesian filter can't 
> catch it).
> 
> Here you have attached one example, please, every helping idea is welcome!
> --------------Attched message follows---------------------
> 
> Return-Path: ana...@ga...
> Received: from imap.tsfundiciones.com (LHLO kirk) (192.1.1.252) by kirk with

I would catch this, and 90% of the rest of them with ehlo/helo does not contain a dot. You may want to consider a rule for that.
-- 
Scott * If you contact me off list replace talklists@ with scott@ *